Can’t logoff user

Environment: Server 2008 Remote Desktop Services

Issue: User reports that they can’t login their account on Remote Desktop Services. They’re greated by Loading Notification Message which spins on forever.

Symptom: Disconnect removes user from session. But when logoff is tried nothing happens. Manually killing the only two processes associated with account doesn’t help (taskmgr, rdclip).

Solution:

1. Check the session ID from Terminal Services Manager for the troubleaccount.
2. Run Sysinternals Process Explorer (from http://live.sysinternals.com/procexp.exe)
3. Add the Session ID to columns
4. Kill the winlogon.exe that have the same Session ID as the troubled account.

Solved.

References:

https://forums.citrix.com/thread.jspa?threadID=258251&tstart=105&start=15

Remote Desktop Services in 2012

Problem:
In a customer environment they wanted to install RDS and DC on the same server. A nice cheap solution, which have worked perfectly fine in the past. Not so anymore. In Server 2012, RDS requires by default that

1. A domain controller is present, aka server is member of a domain
2. the RDS role cannot be installed on the DC

Which means, you need at least two servers for a working installation?
Well no, there is apparently a official workaround from microsoft. It was not easy to find so im posting it here for future reference or until I’ve had time to try it out.
Edit:  A colleague actually tried this out on several machines and it seemed to work as expected.
Solution:
http://support.microsoft.com/kb/2833839/en-us?sd=rss - Guidelines for installing the Remote Desktop Session Host role service on a computer running Windows Server 2012 without the Remote Desktop Connection Broker role service
References:
http://www.wackytechtips.com/installing-and-configuring-remote-desktop-services-rds-on-windows-server-2012/
http://blogs.msdn.com/b/rds/archive/2013/07/09/what-s-new-in-remote-desktop-services-for-windows-server-2012-r2.aspx
http://technet.microsoft.com/en-us/library/hh831447.aspx - specs about rds 2012.
http://technet.microsoft.com/library/hh831568.aspx - deprecated
http://blogs.msdn.com/b/rds/archive/2013/03/14/what-s-new-in-windows-server-2012-remote-desktop-gateway.aspx - changes
http://blogs.technet.com/b/askperf/archive/2012/10/30/windows-8-windows-server-2012-remote-desktop-management-server.aspx - new ways of managing rds
http://www.urtech.ca/2013/02/solved-1-hour-to-install-and-configure-a-single-server-remote-desktop-services-on-server-2012/
http://social.technet.microsoft.com/Forums/windowsserver/en-US/cbffb2d4-ff9d-49ee-a9ce-a60db2262422/managing-server-2012-rds-in-a-workgroup- -
http://support.microsoft.com/kb/2833839/en-us?sd=rss&spid=16526&wa=wsignin1.0 – ms article regarding standalone rds
http://microsoftplatform.blogspot.nl/

Upgrade to IE8 forces Enhanced Security for all Terminal Server users

Major headache.

Scenario: Users on Server 2003 R2 SP2 Terminal Server experience crashes in Internet Explorer. In an effort to kill these problems the browser is upgraded to IE8. This is done while the users are logged on, in past situations this hasn’t been any problems. Changes doesn’t push through until server is rebooted. Not so this time.

30 minutes after IE is upgraded users call in and report that they can’t mark formfields in IE. For example they can’t input text in google searchfield. Strange I think. Probably some locked files, easy done we’ll reboot the server. And yes, this issue disappeared. But instead Internet Enhanced Security is now enforced for all Terminal Server users and they don’t want to allow every single page they're gonna visit. How did this happen? IEES is disabled, both for users and admins in Windows Components.

1.5hours later we finally solved it, but it wasn’t a pretty solution.

Tried and did not succeed :

• Change IEHarden = 0 in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\InternetSettings\ZoneMap]
• Changed GPO to lower security settings

Success:

Deployed DisableIIEES.bat through GPO. Cudos to BrentgMS for the solution. Link to orginal below.

----------------------- DisableIEES.bat -----------------------------

::START

ECHO OFF
REM  IEHarden Removal Project
REM  HasVersionInfo: Yes
REM  Author: Axelr
REM  Productname: Remove IE Enhanced Security
REM  Comments: Helps remove the IE Enhanced Security Component of Windows 2003 and 2008(including R2)
REM  IEHarden Removal Project End
ECHO ON
::Related Article
::933991 Standard users cannot turn off the Internet Explorer Enhanced Security feature on a Windows Server 2003-based terminal server
::http://support.microsoft.com/default.aspx?scid=kb;EN-US;933991

:: Rem out if you like to Backup the registry keys
::REG EXPORT "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" "%TEMP%.HKEY_LOCAL_MACHINE.SOFTWARE.Microsoft.Active Setup.Installed Components.A509B1A7-37EF-4b3f-8CFC-4F3A74704073.reg"
::REG EXPORT "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" "%TEMP%.HKEY_LOCAL_MACHINE.SOFTWARE.Microsoft.Active Setup.Installed Components.A509B1A8-37EF-4b3f-8CFC-4F3A74704073.reg"

REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /v "IsInstalled" /t REG_DWORD /d 0 /f
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" /v "IsInstalled" /t REG_DWORD /d 0 /f

::Removing line below as it is not needed for Windows 2003 scenarios. You may need to enable it for Windows 2008 scenarios
::Rundll32 iesetup.dll,IEHardenLMSettings
Rundll32 iesetup.dll,IEHardenUser
Rundll32 iesetup.dll,IEHardenAdmin
Rundll32 iesetup.dll,IEHardenMachineNow

::This apply to Windows 2003 Servers
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OC Manager\Subcomponents" /v "iehardenadmin" /f /va
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OC Manager\Subcomponents" /v "iehardenuser" /f /va

REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OC Manager\Subcomponents" /v "iehardenadmin" /t REG_DWORD /d 0 /f
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OC Manager\Subcomponents" /v "iehardenuser" /t REG_DWORD /d 0 /f

::REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /f /va
::REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" /f /va

:: Optional to remove warning on first IE Run and set home page to blank. remove the :: from lines below
:: 32-bit HKCU Keys
REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "First Home Page" /f
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t REG_SZ /d "about:blank" /f
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "about:blank" /f
:: This will disable a warning the user may get regarding Protected Mode being disable for intranet, which is the default.
:: See article http://social.technet.microsoft.com/Forums/lv-LV/winserverTS/thread/34719084-5bdb-4590-9ebf-e190e8784ec7
:: Intranet Protected mode is disable. Warning should not appear and this key will disable the warning
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "NoProtectedModeBanner" /t REG_DWORD /d 1 /f

:: Removing Terminal Server Shadowing x86 32bit
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v "IEHarden" /f
::  Removing Terminal Server Shadowing Wow6432Node
REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v "IEHarden" /f

::END

Se link from msdn below for original blogpost for the issue

 

References:

http://serverfault.com/questions/379123/windows-server-2003-r2-terminal-server-internet-explorer-enhanced-security-won

http://blogs.msdn.com/b/askie/archive/2009/06/23/how-to-disable-ie-enhanced-security-on-windows-2003-server-silently.aspx

Great tool for cleaning up on Terminal Servers

Got to use ICSweep today to clean out user tempfiles on a Terminal Server. Very effective. In my case server was loosing all diskspace due to a printer spooler gone awry. Lost 4GB in 3 minutes… a bit distressing…
Check out site below for details
http://www.conetrix.com/Blog/post/Utility-to-Delete-Temp-Files-on-a-Terminal-Server.aspx
http://www.ctrl-alt-del.com.au/CAD_TSUtils.htm